CVE-2021-22175: GitLab unauthenticated SSRF via internal webhook requests

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction required, active CISA KEV listing, and a high EPSS probability make this an urgent patch target.

What it is

GitLab is vulnerable to server-side request forgery when requests to the internal network for webhooks are enabled. The flaw affects all versions starting from 10.5 and can be triggered by an unauthenticated attacker, even when registration is disabled. Because it is reachable without credentials and rated critical, it is a serious exposure for any internet-facing GitLab instance with internal webhook requests enabled.

Impact

An attacker can make the GitLab server issue requests to internal network resources, reaching services that are not otherwise exposed. This can expose internal endpoints, metadata services, or other systems reachable from the GitLab host, with high confidentiality, integrity and availability impact per the CVSS vector.

Attack surface

Reachable over the network via the webhook functionality when internal network requests for webhooks are enabled. No authentication or user interaction is required per the CVSS vector (PR:N, UI:N), and the description states it is exploitable even where registration is disabled.

Exploitation

CVE-2021-22175 is listed in CISA KEV with a due date of 2026-03-11, and EPSS gives a 30-day probability of 0.53372 (99th percentile). A reference is tagged Exploit, indicating public exploit information exists; no ransomware campaign use is documented.

What to do

• Upgrade GitLab to a fixed release per the vendor advisory; patch first.
• If patching is not immediately possible, disable internal network requests for webhooks as directed by GitLab.
• Restrict outbound network access from GitLab servers to only required destinations, blocking internal ranges and cloud metadata endpoints.
• Follow CISA KEV required action and BOD 22-01 guidance, or discontinue use if mitigations are unavailable.
• Review GitLab instances for exposure to untrusted networks and limit access where feasible.

Detection

• Monitor GitLab server outbound requests to internal RFC1918 addresses, loopback, and cloud metadata endpoints (for example 169.254.169.254).
• Alert on webhook configuration changes and on webhook-triggered requests originating from unauthenticated sessions.
• Review GitLab and reverse proxy logs for unusual request patterns to webhook endpoints followed by internal connection attempts.
• Correlate GitLab host network telemetry with known SSRF indicators such as requests to non-standard internal ports.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.